Beyond the Lines – Issue 39

Good morning {{name}},

I’m Tim Buckley, and this is the weekly Beyond the Lines™ newsletter.

Beyond the Lines™ helps current and aspiring CAEs lead Internal Audit Transformation in a Human + AI world, turning insight into decisions, ownership and outcomes.

Built with a broader view across risk, controls, governance and culture, BtL helps internal audit leaders become more board-trusted, decision-ready and future-ready.

Less control theatre. More decisions, ownership and outcomes.

Last week I hosted a Beyond the Lines™ Leadership Signals session with Rania Bejjani on influence without authority. It would be easy to turn that conversation into a simple list of takeaways, but that would miss the more useful point.

The real value was not in a neat set of quotes. It was in the leadership mechanics underneath the conversation.

That is what this week’s issue is about.

Influence, in this context, is not charisma. It is not manipulation. It is not politics. It is not becoming a softer version of internal audit so management feels more comfortable. It is the practical skill of making audit insight clear enough, relevant enough and decision-ready enough to be acted on.

That is a much more serious skill than people often give it credit for.

And if you’re not already following Rania, connect on LinkedIn here.

Miss the live webinar? No worries, you can watch the Leadership Signals replay here.

Internal audit often talks about impact as though it is created by the quality of the work alone. Better planning, better testing, better evidence, better reporting and better root cause analysis are all important. They are also not enough.

Good work still has to land inside a real organisation. That organisation has its own timing, pressure, cost constraints, incentives, politics, capacity problems, leadership preferences and competing priorities. Audit may see a finding clearly, but management may experience it as one more demand on already-stretched attention.

This is where strong audit work can lose momentum. The report may be technically sound. The issue may be accepted. The recommendation may be agreed. The action may be placed on the tracker. But if the issue has not been translated into a clear decision, a credible owner, a visible trade-off and a consequence that matters, the work can be accepted without really changing anything.

It is not a call for audit to own management’s responsibilities. Management owns the risk, the response, the decision and the execution. But internal audit does shape how issues are understood. It shapes whether the right conversation happens early enough. It shapes whether the audit committee sees the real decision or just the polished summary. It shapes whether management leaves the meeting with clarity or just another action to update.

One of the strongest points from the session was that influence is often misunderstood. In audit, risk and governance, we can quietly assume that influence comes from role, title, mandate, charter or reporting line. Those things matter. Internal audit needs authority, independence, access and the right to escalate.

But authority is not the same as movement.

Authority can get audit into the meeting. It can get the issue on the agenda. It can get the finding accepted. It can get the action logged. What it cannot guarantee is that the issue becomes important enough, clear enough or urgent enough for the right person to act.

This distinction matters because modern organisations are not simple command-and-control environments. Many operate through matrix structures, shared accountability, cross-functional processes and blurred ownership. In that environment, audit leaders cannot rely only on formal authority. They need to understand context, incentives and decision dynamics.

If the issue is technically right but commercially disconnected, it will struggle. If the consequence is vague, it will struggle. If the trade-off is hidden, it will struggle. If the accountable owner is unclear, it will struggle. If resistance is treated as irritation rather than information, it will struggle.

Rania and I landed on a common theme in the webinar discussion. Technical strength still matters enormously. Internal audit cannot influence well if the work is weak, the evidence is thin or the judgement is careless. The profession should not talk itself into thinking communication can compensate for poor assurance quality.

But technical strength is increasingly the baseline.

A lot of audit, risk and governance professionals are technically capable. They understand controls, risks, evidence, policy, process and regulation. Where many struggle is not the technical part. It is translating that work into organisational relevance.

That translation is where influence starts.

A finding might say, “The control has not operated effectively.”

A decision-ready conversation says, “Management needs to decide whether the current level of exposure is acceptable until the control is redesigned, and who owns the interim mitigation.”

The first version describes what audit found. The second makes the decision visible.

That is a small shift in wording, but a major shift in usefulness.

Executives are rarely short of information. They are usually surrounded by it. Board packs, project updates, financial reporting, risk dashboards, regulatory papers, customer insight, people metrics, cyber reports, AI updates, governance forums and assurance activity all compete for attention.

The problem is not usually that leaders need more information. The problem is that they need clearer judgement about what the information means and what decision it requires.

That is why audit conversations need to become more decision-ready.

Before taking an issue into a senior conversation, audit should be able to answer six questions.

These questions force a better conversation. They move audit away from simply presenting evidence and towards helping management understand the choice in front of them. They also help audit avoid a common trap: overloading people with technically accurate detail while leaving the real decision implied.

This is not about reducing rigour. It is about making rigour usable.

Another important theme was credibility. Influence is easier when audit is seen as credible, but credibility is not built in one difficult meeting. It is built through the pattern of how audit behaves before the difficult meeting happens.

Credibility is built when audit adds useful insight, challenges fairly, understands the business context, follows through, times messages well and avoids overstating the issue. It is built when audit is seen as objective rather than theatrical, practical rather than academic, and challenging without being careless about the pressure the business is under.

That does not mean audit should become easy to deal with. Some audit conversations should be uncomfortable. Some messages need to be escalated. Some issues need to be held firmly, even when management would rather move on.

During the webinar, Rania described a crisis situation where the audit and risk role was not to sit on the sidelines commenting on everything that had gone wrong. It was to be close enough to help, objective enough to explain the risk and control perspective, and credible enough to support a more useful board conversation. That is a strong distinction.

Audit should not become management. But audit should not confuse independence with being absent until it is time to criticise.

Most audit leaders have experienced resistance. Sometimes it is open pushback. Sometimes it is silence, delay, defensiveness, over-detailing, repeated rewording, missed action dates or the issue being quietly reframed away from the real problem.

It is easy to treat all of this as management being difficult. Sometimes it is. But resistance can also be a useful diagnostic signal.

Pushback may mean management disagrees with the conclusion. It may also mean they fear the personal consequence. Silence may mean low trust. Delay may mean the action is unrealistic, the owner is wrong or the consequence has not landed. Over-detailing may be a way of avoiding the decision. Reframing the issue may be a sign that the real trade-off has not been named.

This does not mean audit should accept weak excuses. It means audit should diagnose before pushing harder.

There are two responses to resistance. The first is tactical: stay calm, do not personalise it, separate emotion from substance and pause the conversation if it is going nowhere. The second is strategic: work out what the resistance is protecting, what consequence has not landed, and what needs to be reframed for the issue to move.

That is a mature audit skill.

Independence is another area where audit can create unnecessary distance. Internal audit absolutely needs independence. It needs impartial objectivity, freedom from interference and the ability to report honestly.

But independence does not mean sitting in an ivory tower.

At one extreme, audit becomes too distant. It lacks context, arrives late, challenges from the sidelines and is easy to dismiss as theoretical. At the other extreme, audit becomes too embedded. It starts designing the fix, owning the response, blurring accountability and weakening its future assurance position.

The strong middle is harder.

Audit should be close enough to understand, objective enough to challenge, useful without owning, and independent without being detached. That is the line audit leaders have to hold.

Audit can clarify the issue. It can test evidence. It can map the process. It can explain consequence. It can challenge whether the response is credible. But it must not own management decisions, management remediation, operational execution or risk acceptance on management’s behalf.

A useful boundary question is: are we helping management see the decision more clearly, or are we starting to own the response?

AI will increase the volume and polish of organisational information. It will help draft reports, summarise data, generate risk narratives and make documents look more complete, more quickly.

That is useful. It is also dangerous if the underlying judgement is weak.

A smoother report is not necessarily a sharper message. A faster summary is not necessarily a better decision. A polished paragraph is not proof that the issue has been understood, challenged or acted on.

As AI handles more of the mechanical work, the human skills become more important, not less. Context, judgement, credibility, ethical influence, challenge, empathy, simplification and the ability to move insight into action will separate the audit leaders who create value from those who simply produce more content.

AI can organise the work.

Humans still have to decide what matters.

A simple way to test whether an audit issue is ready for a senior conversation is to run it through six filters.

First, context. Do we understand the environment this issue is landing in, including timing, pressure, incentives and competing priorities?

Second, consequence. Have we made clear why the issue matters now and what happens if it is left unresolved?

Third, trade-off. Have we named the real tension management is facing, whether that is cost, speed, capacity, control, ownership or risk appetite?

Fourth, owner. Is the accountable decision-maker visible, or has the issue disappeared into a general action plan?

Fifth, resistance. Have we considered what may stop this moving, including fear, overload, low trust or misaligned incentives?

Finally, decision. Have we made the required decision explicit?

If the answer is no, the issue may still be technically valid. It may just not be decision-ready yet.

Pick one issue that is currently stuck. It could be an overdue action, a repeated finding, a remediation plan that keeps slipping, or an audit committee point that generated discussion but no movement.

Now rewrite it as a decision.

Instead of saying, “Management has not implemented the agreed control,” try: “Management needs to decide whether the current level of exposure is acceptable until the control is implemented, and who owns the interim mitigation.”

Then ask what trade-off sits underneath it. Is this really about cost, capacity, ownership, timing, local process variation, system limitation or risk appetite? After that, ask what resistance may block movement. Is the issue not understood? Is the consequence too vague? Is the action unrealistic? Is the wrong person being asked to own it?

Start with one stuck issue and make the decision clearer.

Influence is not about being liked, loud or political. It is not audit giving up independence. It is not management consulting dressed up as assurance.

For internal audit leaders, influence is the practical skill of helping good work land. It is how evidence becomes a conversation, how a conversation becomes a decision, how a decision becomes ownership, and how ownership becomes an outcome.

That is where audit becomes more board-trusted.

Not because the report is polished.

Because the work leads somewhere.

Best,

Tim Buckley

Founder Beyond the Lines™ | Integral Assurance

Watch the Leadership Signals replay
Influence without authority: how audit and risk actually get decisions made.

Share Beyond the Lines with a colleague
If this helped you think differently about internal audit leadership, forward it to one audit, risk or controls colleague who would value it.

Most small business owners have financials, but few have financial clarity. There's a real difference between books that are technically up to date and books that actually tell you what's going on in your business right now. When accounting is reactive — updated when there's time, reviewed at tax season — you lose visibility exactly when you need it most. You can't tell which clients are truly profitable. You can't spot a cash flow gap before it becomes a crisis. BELAY's outsourced accounting team changes that.

Download the Free Guide